CVE-2026-126392
- Source
- https://cve.org/CVERecord?id=CVE-2026-126392
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126392.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-126392
- Aliases
-
- GHSA-4m87-fqwv-2m8v
- Published
- 2026-11-13T09:35:53Z
- Modified
- 2026-11-14T10:31:05Z
- Severity
-
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update
- Details
-
Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-203" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126392.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126392.json
- https://github.com/parse-community/parse-server/security/advisories/GHSA-4m87-fqwv-2m8v
- https://nvd.nist.gov/vuln/detail/CVE-2026-126392
- https://www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.8-alpha.1-information-disclosure-via-dot-notation-update
Affected packages
Git / github.com/parse-community/parse-server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/parse-community/parse-server
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "9.10.6-alpha.1" }, { "fixed": "9.10.8-alpha.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "8.6.109" }, { "fixed": "8.6.118" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }